Token refresh, add restrictions to API's that don't support token refresh